CVE-2018-1000614

CVE-2018-1000614 affects ONOS Controller version 1.13.1 and earlier. The XML External Entity (XXE) vulnerability is in providers/netconf/alarm/NetconfAlarmTranslator.java, allowing a remote, unauthenticated attacker to launch XXE attacks via crafted protocol messages. CVSSv3 base score 9.8 (CRITI...

CVE-2018-1000614

ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity XXE vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary can remotely launch advanced XXE attacks on ONOS controller...

CVE-2018-1000615

CVE-2018-1000615 affects ONOS Controller (versions

CVE-2018-1000616

CVE-2018-1000616 affects ONOS controller versions 1.13.1 and earlier. The vulnerability is a XML External Entity (XXE) flaw in XmlConfigParser.loadxml() that can enable remote XXE attacks over network via an OpenConfig Terminal Device. Multiple sources (including Red Hat, Veracode, OSV, NVD/CVE r...

CVE-2018-12691

Time-of-check to time-of-use TOCTOU race condition in org.onosproject.acl aka the access control application in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection...

Race condition

Time-of-check to time-of-use TOCTOU race condition in org.onosproject.acl aka the access control application in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection...

CVE-2018-12691

Time-of-check to time-of-use TOCTOU race condition in org.onosproject.acl aka the access control application in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection...

CVE-2018-12691

The vulnerability CVE-2018-12691 affects the org.onosproject.acl component in ONOS versions up to v1.13. It is caused by a TOCTOU race condition that allows an attacker to bypass network access control by sending data plane packets, enabling bypass of ACL checks. The available documents consisten...

CVE-2018-12691

Time-of-check to time-of-use TOCTOU race condition in org.onosproject.acl aka the access control application in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection...

Cross site scripting

ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS...

CVE-2017-13763

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited...

CVE-2017-13762

ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS...

CVE-2017-13763

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited...

Design/Logic Flaw

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited...

CVE-2017-13762

ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS...

CVE-2017-13762

ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS...

CVE-2017-13763

CVE-2017-13763 affects ONOS versions 1.8.0, 1.9.0, and 1.10.0. The root cause is lack of an upper bound on memory allocation for Netty payloads, i.e., Netty payload size is not limited. This has been linked to a denial-of-service risk on ONOS clusters (e.g., nodes timing out when connecting to th...

CVE-2017-13763

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited...

Unspecified Vulnerability in ONOS

ONOS is a new carrier-grade SDN network operating system. An unspecified vulnerability exists in ONOS versions 1.8.0, 1.9.0, and 1.10.0. An attacker can exploit the vulnerability to make the Netty payload size unlimited...

CVE-2017-13762

CVE-2017-13762 affects ONOS versions 1.8.0, 1.9.0, and 1.10.0 and is described as a cross-site scripting (XSS) vulnerability. The connected sources consistently state that these ONOS releases are vulnerable to XSS (e.g., NVD, Red Hat, CNVD, OSV). The exact root cause, affected component/file, exp...